Associate Director, Privacy Law & Compliance

At Bristol Myers Squibb, our employees often ask, “Who are you working for?”—a question that fuels collaboration, accountability, and urgency in our work. Our purpose-driven culture inspires us to discover, develop, and deliver innovative medicines to prevail over serious diseases. We offer uniquely interesting and meaningful work, opportunities for growth, and a supportive environment that values inclusion, wellbeing, flexibility, and comprehensive benefits. This is work that transforms the lives of patients, and the careers of those who do it.

Bristol Myers Squibb is seeking an experienced and strategic Associate Director, Privacy Law & Compliance (Regional Privacy Counsel) - based in Warsaw - for Europe, the Middle East and Africa (EMEA) to join our Global Privacy Law & Compliance team. This role is critical in ensuring BMS' data privacy and protection practices comply with the diverse and evolving regulatory landscape across EMEA jurisdictions, while enabling the business to innovate and operate efficiently. This person will serve as the primary legal advisor on all privacy matters affecting BMS' EMEA operations, working cross-functionally with business units including Commercial, Medical Affairs, IT, and HR.

Key Responsibilities

• EMEA Privacy Legal Advisor. Serve as the subject matter expert on data privacy laws across EMEA jurisdictions, including the EU (GDPR), UK (UK GDPR/DPA 2018), Switzerland (FADP), Turkey (KVKK), the Gulf states (UAE Federal PDPL, UAE DIFC/ADGM data protection regimes, Saudi Arabia PDPL, Qatar PDPL, Bahrain PDPL), Israel (Privacy Protection Law), and Sub-Saharan and North Africa (South Africa POPIA, Nigeria NDPA, Kenya DPA, Egypt PDPL, and other emerging frameworks).

• Business Stakeholder Advisory. Advise business partners on privacy risks and legal obligations associated with new and existing initiatives across the region.

• Compliance Program Advice. Work with Director, Global Privacy Compliance to ensure accurate and actionable regional privacy compliance program in alignment with global privacy standards and policies

• Privacy Impact Assessments. Conduct PIAs and DPIAs for EMEA-specific initiatives and maintain records of processing activities (RoPA) for EMEA entities.

• Regulatory Monitoring. Track regulatory developments across EMEA and ensure timely updates to internal policies, procedures, and controls.

• Cross-Border Data Transfers. Advise on applicable transfer mechanisms (including EU Standard Contractual Clauses, UK IDTA/Addendum, Binding Corporate Rules, and adequacy decisions) and review/negotiate DPAs, vendor contracts, and data sharing arrangements with EMEA partners.

• Training & Awareness. Develop and deliver region-specific privacy training programs for EMEA employees, contractors, and third parties; foster a culture of privacy accountability.

• Incident Response. Support, as needed, EMEA privacy incident triage, investigation, notification, and remediation efforts (including breach notification timelines) in coordination with IT department along.

Qualifications

• Education: Law degree (LLB, JD, or equivalent); license to practice law in at least one EMEA jurisdiction (EU member state, UK, or other EMEA jurisdiction).

• Experience: Minimum 5-8 years of legal experience, with at least 5 years focused on data privacy and protection law in the EMEA region.

• Deep expertise in at least three or more EMEA data privacy regimes (e.g., GDPR, UK GDPR, POPIA, UAE PDPL, Saudi PDPL).

• Demonstrated experience advising on cross-border data transfer mechanisms and international privacy frameworks.

• Prior experience in the life sciences, pharmaceutical, or healthcare sector strongly preferred.

• Proven ability to navigate complex, multi-jurisdictional privacy issues with business pragmatism.

• Strong negotiation skills for data processing and vendor agreements.

• Excellent communication skills in English; proficiency in at least one additional EMEA language (French, German, Arabic, or Portuguese) highly desirable.

Please note that this position is not a remote working opportunity and is based in the local BMS office, following a hybrid work model with at least 50% onsite attendance at your assigned facility.

#LI-HYBRID

We hire for skills and capabilities, not just credentials – if this role excites you, but doesn’t perfectly match your resume, we encourage you to apply anyway.

Warsaw - PL: zł327,250 - zł396,550

The starting compensation range(s) for this role are listed above for a full-time employee (FTE) basis. Additional incentive cash and stock opportunities (based on eligibility) may be available. The starting pay takes into account characteristics of the job, such as required skills, where the job is performed, the employee’s work schedule, job-related knowledge, and experience. The final compensation will be determined based on demonstrated experience and in accordance with pay equity principles and applicable employment laws.

How We Work

Where you work matters – because collaboration, innovation and patient impact happen in many settings. Our roles are structured across four work models: site-essential, site-by-design, field-based and remote-by-design. The model assigned to this role is based on its core responsibilities. Learn more at https://careers.bms.com/ways-of-working.

Supporting People with Disabilities

BMS is dedicated to ensuring that people with disabilities can excel through a transparent recruitment process, reasonable workplace accommodations/adjustments and ongoing support in their roles. Applicants can request a reasonable workplace accommodation/adjustment prior to accepting a job offer. If you require reasonable accommodations/adjustments in completing this application, or in any part of the recruitment process, direct your inquiries to adastaffingsupport@bms.com. Visit careers.bms.com/eeo-accessibility to access our complete Equal Employment Opportunity statement.

Candidate Rights

BMS will consider qualified applicants with arrest and conviction records, pursuant to applicable laws in your area.

For roles based in Los Angeles County only:  If you live in or expect to work from Los Angeles County if hired for this position, please visit this page for important additional information: https://careers.bms.com/california-residents/

Data Protection

We will never request payments, financial information, or social security numbers during our application or recruitment process. Learn more about protecting yourself at https://careers.bms.com/fraud-protection.

Any data processed in connection with role applications will be treated in accordance with applicable data privacy policies and regulations.

If this posting is missing required information required by local law or incorrect, contact BMS at TAEnablement@bms.com with the Job Title and Requisition number. Do not send application-related inquiries to this email. To check your application status, please login to your Candidate Home Account.

R1606359 : Associate Director, Privacy Law & Compliance